package com.dzh.config;

import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

import java.net.Authenticator;

//AOP ：拦截器
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    //链式编程
    @Override
    protected void configure(HttpSecurity http) throws Exception{
       //首页所以人可以访问，功能页只对应的人能够访问
        //请求授权的规则
//        http.authorizeRequests()
//                .antMatchers("/").permitAll()
//                .antMatchers("/level1/**").hasRole("vip1");
        //没有权限会回到登录界面
     //   http.formLogin();

   //注销功能 ，跳到首页
        //防止网站的工具：get ，post
        http.csrf().disable();//关闭csrf功能
        http.logout().logoutSuccessUrl("/");
        //记住我功能
        http.rememberMe().rememberMeParameter("remember");


    }
    //认证，spring 2.1.x可以直接使用
    //密码编码 ：PasswordEncoder
    //在Spring Security 5.0+ 新增了很多方法
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception{
    //正常的数据应该在数据库里面取
//        auth.inMemoryAuthentication().passwordEncoder(new BCryptPasswordEncoder())
//                .withUser("dzh").password((new BCryptPasswordEncoder()).roles("vip1","vip2");
    }



}
